How can i handle a sign-in fail to redirect to angular with OpenIdConnectEvents

I have setup an bff application architecture with an angular SPA app and a .net 9 web api that use open id connect to do single sign on with microsoft entra id and microsoft, google identity provider.

I have done basicly the same thing that is explained by damien bod in this example : https://github.com/damienbod/bff-aspnetcore-angular

The signin work and redirect to the angular page i have configured.

But, i'm wondering how to deal with user that login but aren't suppose to access the app because their user is not active or have beed remove in the app database.

I found that i can use OpenIdConnectEvents to handle this but i'm confuse how to return the unauthorized information to angular.


builder.Services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
options.Events = new OpenIdConnectEvents
{
OnTokenValidated = async context =>
{
if (context.Principal?.Identity is not ClaimsIdentity claimsIdentity)
return;

var userName = claimsIdentity.FindFirst("preferred_username")?.Value;

context.HttpContext.RequestServices.GetRequiredService<IUserServiceRepository>();

var usager = await userServiceRepository.GetUsager(userName);

if (usager != null)
{
context.Fail("Unauthorized");

}
}
};
});


When i use this method the web api get redirected to the https://localhost:7143/signin-oidc endpoint with an exception.

Should i just not sign the user and do an api call to check if i'm authenticated after the redirect from https://localhost:7143/signin-oidc.

Some example i found explain that i can sign-in the user with a access denied claim new Claim("access_denied", "true").

I found it weird to consider it sign-in when it should not sign-in and have access.

I'm just wondering is there a good way of doing this kind of flow.



Continue reading...